CVE-2025-1510 is a high severity code injection flaw in the Custom Post Type Date Archives WordPress plugin, all versions up to and including 2.7.1. An action runs do_shortcode on a value that is not validated, so unauthenticated visitors can run arbitrary shortcodes. NVD scores it 7.3. The plugin has been closed on WordPress.org, so remove it.
What's affected
The record lists Custom Post Type Date Archives by keesiemeijer, all versions up to and including 2.7.1. The WordPress.org plugin page, which we fetched, says the plugin was closed as of 20 February 2025 and is not available for download, with the reason given as a security issue. No fixed version is named. The record is sourced from Wordfence, whose entry is linked from the CVE.
How to check if you're exposed
Check whether the plugin is installed on any site, using WP-CLI from each site's root.
wp plugin list --fields=name,status,version | grep custom-post-type-date-archives
If you manage many sites, run the same check across them, or look under Plugins in each dashboard. A deactivated plugin still sits on disk and its code may still be reachable, so look at inactive entries too.
wp plugin deactivate custom-post-type-date-archives
wp plugin delete custom-post-type-date-archives
The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) shows the attack needs no account at all and no user interaction, so any site with the plugin present is exposed to anyone who can reach it.
What to do now
- Find every WordPress site that has
custom-post-type-date-archivesinstalled, active or not. - Deactivate and delete the plugin. It has been closed by the WordPress.org team, so do not expect an update.
- If you rely on the function, replace it with a maintained plugin or a few lines of theme code you control.
- Review recent content and options for unexpected shortcode output, and check admin users for accounts you do not recognise.
- Add a plugin policy: remove anything unmaintained, closed or no longer used, and review the list each quarter.
Why it matters
The weakness is CWE-94, code injection. In this case the unsafe step is calling do_shortcode on a value the visitor controls. Shortcodes are small pieces of code that WordPress expands into content, and some plugins register shortcodes that read data or perform actions. Letting outsiders choose which one runs gives them a menu of behaviours the site owner never meant to offer.
How bad it gets depends on which shortcodes the site has installed, so impact varies from nothing to serious. The record scores it 7.3. It is not on the CISA KEV list. The general lesson is to treat any code path that expands user input as executable.
Going further
WordPress sites collect plugins over time, and the ones that cause trouble are often small utilities installed once and forgotten. A short monthly review that removes anything unused cuts exposure more than most scanners do.
If you operate a fleet of sites, keep a central list of plugin slugs and versions. Then a CVE like this one is a search, not a hunt.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a patched version available?
The WordPress.org page says the plugin is closed for a security issue and unavailable for download, so remove it.
Does deactivating the plugin protect me?
Deactivating stops WordPress from loading it. Deleting is cleaner because files left on disk are an extra thing to track.
Sources
- Safeguard Gold record for CVE-2025-1510
- NVD entry for CVE-2025-1510
- Fetched reference on wordpress.org
Last reviewed: 19 October 2026.
